Factored out so we can substitute other implementations here if desired, such as the one in ActiveRBAC. @private
[Validate]